RocketChat/Rocket.Chat 9.0.0-rc.0

on GitHub

Engine versions

• Node: 22.22.3
• Deno: 2.3.1
• MongoDB: 8.0
• Apps-Engine: 1.64.1-rc.0

Major Changes

• (#40721) ## Phishing-Resistant Multi-Factor Authentication

  Introduces a more secure and reliable server-side OAuth authentication flow.

  What’s New

  • Improved OAuth login security
    OAuth authentication now happens fully on the server, reducing the risk of token theft, phishing attacks, and client-side credential interception.
  • Built-in CSRF, state validation, and PKCE protection
    OAuth logins now include stronger protection against CSRF attacks, request tampering, and authorization code interception through secure state validation and PKCE support.
  • Improved two-step verification with OAuth logins
    Users with email or TOTP two-factor authentication enabled will now be asked to complete 2FA even when signing in with providers like Google, GitHub, GitLab, and others.
  • Improved mobile & desktop app login
    Mobile and desktop apps now support a smoother and more secure deep-link OAuth login flow.
  • A new setting to enable/disable new OAuth Flow
    Enable this new setting Accounts_OAuth_Use_Modern_Flow to use all of the above mentioned features.

Minor Changes

• (#40351) Adds current field to DeviceManagementSession type and currentLoginToken parameter to aggregateSessionsByUserId, allowing the sessions endpoint to identify and flag the caller's active session.

• (#40890) Adds AI Search with semantic message results, optional OpenAI-compatible answers, and AI Center configuration.

• (#39324) Adds support for running Rocket.Chat in FIPS mode. The monolith and all microservices (ddp-streamer, account-service, authorization-service, presence-service, queue-worker, omnichannel-transcript) can now enforce FIPS-compliant cryptography via Node.js/OpenSSL FIPS, with dedicated FIPS Docker images. Running in FIPS mode requires a license including the new fips module, and FIPS status is now reported in server logs and statistics.

• (#40721) ## Phishing-Resistant Multi-Factor Authentication

  Introduces a more secure and reliable server-side OAuth authentication flow.

  What’s New

  • Improved OAuth login security
    OAuth authentication now happens fully on the server, reducing the risk of token theft, phishing attacks, and client-side credential interception.
  • Built-in CSRF, state validation, and PKCE protection
    OAuth logins now include stronger protection against CSRF attacks, request tampering, and authorization code interception through secure state validation and PKCE support.
  • Improved two-step verification with OAuth logins
    Users with email or TOTP two-factor authentication enabled will now be asked to complete 2FA even when signing in with providers like Google, GitHub, GitLab, and others.
  • Improved mobile & desktop app login
    Mobile and desktop apps now support a smoother and more secure deep-link OAuth login flow.

• (#41019) Adds an alternative runtime runner for apps. It can be enabled via environment variable APPS_ENGINE_RUNTIME_BACKEND='node'

• (#41142) Adds inline JSON validation feedback to admin settings that hold JSON (code: application/json), showing an error in the editor and blocking save while the value is malformed

• (#40916) Adds a new licenses.validate REST endpoint that validates a Rocket.Chat license (V2 or V3 JWT) against the current workspace without applying it, so a license can be previewed before it is applied from the UI. A valid license responds with success; an invalid one responds with the validation behaviors that rejected it.

• (#39411) Replaces proprietary emojis with native (unicode) emojis and increases available emoji set

• (#41148) Adds support for the offline license flag, suppressing every outbound connection to Rocket.Chat Cloud services and the Push Gateway at its source, so air-gapped workspaces never initiate calls that would violate their security compliance.

• (#41120) Added a persistent audio player. Playing an audio attachment now continues across room navigation: the audio keeps playing when you switch or close the conversation, and a "Now playing" card appears at the top of the sidebar with play/pause, seek, playback speed (1x/1.5x/2x), and a shortcut back to the originating conversation.

• (#40728) Deprecates the logoutCleanUp DDP method and stops the client from calling it. The post-logout side effects (afterLogoutCleanUpCallback + Apps.IPostUserLoggedOut) now run server-side via a new Accounts.onLogout handler and from POST /v1/users.logout, so both DDP and REST logout paths fire them without a client round-trip. The DDP method keeps its original implementation and registration with a deprecation log pointing at /v1/users.logout until 9.0.0.

• (#40728) Added POST /v1/cloud.connectWorkspace (replaces the deprecated cloud:connectWorkspace DDP method). Body is { token }; auth-gated with manage-cloud permission. The legacy DDP method remains registered with a deprecation log pointing at the new route.

• (#40728) Added POST /v1/integrations.clearHistory and POST /v1/integrations.replayOutgoing (replace the deprecated clearIntegrationHistory and replayOutgoingIntegration DDP methods). Bodies { integrationId } and { integrationId, historyId } respectively. Permissions (manage-outgoing-integrations or manage-own-outgoing-integrations) are enforced the same way the DDP methods did. Legacy DDP methods remain registered with deprecation logs pointing at the new routes.

• (#40728) Added POST /v1/permissions.addRole and POST /v1/permissions.removeRole (replace the deprecated authorization:addPermissionToRole and authorization:removeRoleFromPermission DDP methods). Body is { permissionId, role } on both. The same per-user permission checks (access-permissions, access-setting-permissions) the DDP methods enforced are reused. Legacy DDP methods remain registered with deprecation logs pointing at the new routes.

• (#40728) Extended POST /v1/users.setAvatar to accept an optional service multipart field. When provided, the value is stored as the user's avatarOrigin, matching what the deprecated setAvatarFromService DDP method did. The legacy DDP method remains registered with a deprecation log pointing at the new route.

• (#40728) Added POST /v1/users.verifyEmail (replaces the two-call DDP flow of verifyEmail + afterVerifyEmail). Body is { token }; the server resolves the user, marks the email verified, and runs the anonymous→user role swap in a single request. The deprecated afterVerifyEmail DDP method keeps its registration with a deprecation log pointing at the new route.

• (#40916) Adds a manage license flow to the subscription admin page, allowing license verification before applying it and an option to remove the license. Note: From this point license management should be made in subscription page instead of the Enterprise settings page.

Patch Changes

• (#41174) Fixes race conditions in several check-then-write database flows by collapsing them into single atomic operations: CAS login tokens can no longer be consumed by two concurrent logins, revoking a room invite no longer emits duplicate removal notifications, and deleting an integration now enforces the creator-only permission scope in the delete itself

• (#41152) Fixes own account showing twice in navbar room search when searching by username

• (#41285) Fixes the Slack importer storing shared files as raw URLs in the message body. Imported file messages now stay hidden until "Download Pending Files" button fetches them, then display as native attachments with image previews. Failed downloads (e.g. invalidated export links) are no longer silently saved as the file's content — they are counted as errors and can be retried.

• (#41056) Added a setUserRoles bridge method to the desktop API and pushed the logged-in user's roles to the desktop app. This lets the desktop client restrict supportedVersions messages (such as version-expiration warnings) to specific roles like admins, instead of showing them to every user. The push is reactive to role changes; desktop builds without the bridge method fall back to their own role lookup.

• (#41207) Fixes engagement dashboard loading unnecessary data into memory on startup

• (#41173) Fixes the password policy allowing a maximum length lower than the minimum length to be saved — a combination that made it impossible to set any valid password. The server now rejects such configurations when password policy settings are saved and shows an error explaining the constraint.

• (#41233) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)

• (#41195) fix: Buttons from emoji picker misbehaving on clicks

  An infinite render loop was preventing proper behavior when clicking on the emoji picker buttons. It was fixed by removing the unnecessary state update that was causing the loop and replacing multiple fires of the same mouseover event (when a mouseenter event was the right one to use). There is a chance this pre-existing bug was hidden by React 18's event delegation.

• (#41158) Fixes agents' business-hour availability not being updated when they are removed from a department linked to a business hour while multiple business hours are enabled. The recomputation step always failed, leaving removed agents available (or unavailable) according to a business hour that no longer applied to them — and, on deployments running with EXIT_UNHANDLEDPROMISEREJECTION (or in development/test mode), the unhandled rejection crashed the server process.

• (#41164) Fixes multiple business hours losing their linked departments after a daylight saving time change or a server restart. The automatic timezone adjustment re-saved business hours without their department associations, causing business hours configured with timezones to silently stop applying to agents.

  Also fixes agents keeping a business hour's availability after their department was removed from it: saving a business hour with a smaller department list unlinked the departments but never cleared the business hour from the removed departments' agents.

• (#41472) Fixes the license provided via the ROCKETCHAT_LICENSE environment variable not being applied when it is newer than the one persisted in the workspace.

• (#40351) Fixes error message being shown when logging out current device via Device Management despite successful logout.

• (#41169) Fixes a race condition that left messages permanently undecryptable ("incorrect encryption key") in rooms created with encryption enabled. When several members opened such a room at the same time, each client could independently generate and distribute a different group key. Establishing the room key is now atomic (first-write-wins) on the server, and a client that loses the race discards its locally generated key and adopts the established one instead of encrypting with a divergent key.

• (#41069) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)

• (#41168) Fixes LDAP channel sync aborting the entire add/removal pass when a mapped channel could not be resolved, which prevented users from being removed from channels when "Auto Remove Users from Channels" was enabled.

• (#41279) Fixes LDAP sync failing to merge an existing user matched by email, which caused a Username already exists error when the user's username differed from the directory.

• (#41373) Fixes the server crashing during LDAP login or sync when the configured search settings produce an invalid LDAP filter (for example, an empty User Search Field). The operation now fails gracefully with a logged error instead of terminating the process.

• (#41202) Disables more actions on message composer during public channel preview.

• (#41480) Fixes an issue where the "user left" system message could be added to an Omnichannel conversation only after the forwarding process had already finished, causing it to appear out of order in the conversation history

• (#41110) Passes the original message text to the message renderer so blocks without a dedicated renderer (e.g. tables on clients that don't render them yet) can degrade to their raw markup via the parser's fallback source offsets, instead of disappearing.

• (#41074) Fixes an issue where the cursor jumped to the wrong position after inserting a mention at the start or middle of a message.

• (#41304) Fixes wrong FederationLookup type assigned to IUser in apps. The correct data is there, but the type does not represent it.

• (#41089) Enables keyboard activation for Display menu radio buttons and checkboxes

• (#41204) Changes the date columns in the Omnichannel Contact Center to show both the formatted date and the relative time: the Last Chat column in the contacts list, and the Started at and Last Message columns in the chats list

• (#41341) Fixes a server crash when re-enabling the "Enable Push" setting after it was disabled. Push notifications are now fully reconfigured on re-enable, so settings changed while push was disabled are picked up as well.

• (#40768) Ensures the users.CreateToken endpoint checks for the user-generate-access-token permission when generating a login token for another user

• (#41206) Ensures room permission checks are applied consistently regardless of how the room is identified when converting a channel to a team or creating a team from an existing room

• (#41414) Restores Away as a selectable preset in the quick status menu, custom status modal, and account profile page.

• (#41145) Fixes the SAML Single Logout response so the RelayState matches the exact value received on the logout request, as required by the SAML specification, instead of using Rocket.Chat's own URL

• (#41254) Fixes the setup wizard being forced back into the registration step on the first start after an upgrade when OVERWRITE_SETTING_Show_Setup_Wizard=completed is set, which affected air-gapped workspaces running offline licenses without cloud registration.

• (#41122) Adds keyboard navigation support in Room members list

• (#41112) Returns custom fields on admin rooms detail view

• (#41101) Improved /v1/spotlight search performance: results return faster, and room searches now read from secondary database replicas when available, reducing load on the primary.

• (#41402) Fixes broken pagination on rooms.bannedUsers and on omnichannel department listing endpoints, which ignored the offset parameter and always returned results from the first page. Also reduces payload over-fetching on several endpoints that unintentionally loaded full documents (rooms.hide, private group lookups, direct email replies, omnichannel auto-transfer), and removes the permissive model query typings that allowed these invalid find options to compile unnoticed.

• (#41229) Fixes dates showing one day earlier for users in negative UTC-offset timezones

• (#41200) Fixes an issue where the whole app remounts when VoIP availability changes

• Updated dependencies [c7aff48, 5f92f9a, 70c0ff0, 13b4a7b, eec6083, 4b34bd6, adc1570, 1bf84cb, 4b57346, 8d8cd01, 297df1a, 6ebabce, 13b4a7b, ffe1b64, 784c287, 3cd7db6, 115dfe8, 719e3db, b2b5edf, 74d6cac, 4186deb, 4117a1d, 376c9d8, 73c3aec, 73c3aec, 73c3aec, 73c3aec, 615ae2b, b2b5edf, 1cc7bbd, 6041285, e5da5d0, 2ec4d29, 70c0ff0, 1637a8b]:

  • @rocket.chat/model-typings@3.0.0-rc.0
  • @rocket.chat/core-typings@9.0.0-rc.0
  • @rocket.chat/models@3.0.0-rc.0
  • @rocket.chat/gazzodown@33.0.0-rc.0
  • @rocket.chat/web-ui-registration@33.0.0-rc.0
  • @rocket.chat/rest-typings@9.0.0-rc.0
  • @rocket.chat/passport-x@1.0.0-rc.0
  • @rocket.chat/i18n@4.0.0-rc.0
  • @rocket.chat/message-parser@0.32.0-rc.0
  • @rocket.chat/core-services@0.15.0-rc.0
  • @rocket.chat/ai-search@0.2.0-rc.0
  • @rocket.chat/ui-client@33.0.0-rc.0
  • @rocket.chat/federation-matrix@0.2.0-rc.0
  • @rocket.chat/apps@0.8.0-rc.0
  • @rocket.chat/license@1.2.0-rc.0
  • @rocket.chat/apps-engine@1.64.1-rc.0
  • @rocket.chat/ui-voip@23.0.0-rc.0
  • @rocket.chat/omnichannel-services@0.3.56-rc.0
  • @rocket.chat/abac@0.3.1-rc.0
  • @rocket.chat/media-calls@0.5.2-rc.0
  • @rocket.chat/pdf-worker@0.3.36-rc.0
  • @rocket.chat/presence@0.3.1-rc.0
  • @rocket.chat/api-client@0.2.57-rc.0
  • @rocket.chat/cron@0.1.59-rc.0
  • @rocket.chat/ddp-client@1.1.2-rc.0
  • @rocket.chat/fuselage-ui-kit@33.0.0-rc.0
  • @rocket.chat/http-router@7.9.24-rc.0
  • @rocket.chat/message-types@0.1.1
  • @rocket.chat/ui-avatar@29.0.0-rc.0
  • @rocket.chat/ui-contexts@33.0.0-rc.0
  • @rocket.chat/omni-core-ee@0.0.24-rc.0
  • @rocket.chat/instance-status@0.1.59-rc.0
  • @rocket.chat/omni-core@0.1.3-rc.0
  • @rocket.chat/server-fetch@0.2.3-rc.0
  • @rocket.chat/network-broker@0.2.38-rc.0
  • @rocket.chat/ui-composer@4.0.0-rc.0
  • @rocket.chat/server-cloud-communication@0.0.3
  • @rocket.chat/ui-video-conf@33.0.0-rc.0